Merge pull request #220 from cs341-illinois/fix-ci-python-version

Fix CI: python 3.7 is unavailable on ubuntu-latest

.github/workflows/build.yaml

@@ -17,12 +17,16 @@ jobs:
 
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
+    # Python 3.7 has no build for ubuntu-24.04 (which ubuntu-latest now
+    # points at), so setup-python could not find it. 3.9 is the newest
+    # release that still works with the pinned panflute 1.10.6, which
+    # imports MutableSequence from collections (removed in 3.10).
     - name: Setup python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
-        python-version: 3.7
+        python-version: '3.9'
 
     - name: Install
       run: |

.github/workflows/deploy.yaml

@@ -17,13 +17,16 @@ jobs:
 
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
-    - name: Setup python (3.7.17)
-      uses: actions/setup-python@v2
+    # Python 3.7 has no build for ubuntu-24.04 (which ubuntu-latest now
+    # points at), so setup-python could not find it. 3.9 is the newest
+    # release that still works with the pinned panflute 1.10.6, which
+    # imports MutableSequence from collections (removed in 3.10).
+    - name: Setup python
+      uses: actions/setup-python@v5
       with:
-        python-version: 3.7.17
-         #3.6.15
+        python-version: '3.9'
 
     - name: Install
       run: |

_scripts/pandoc_header_filter.py

@@ -20,6 +20,10 @@ import requests
 
 link_cache_days = 30
 
+# Per-request timeout for the link check. Without this a host that
+# blackholes connections stalls the build for minutes.
+link_timeout_seconds = 15
+
 # Metadata gleaned from the file
 meta = dict(
     name="",
@@ -129,10 +133,21 @@ def output_yaml(elem, doc):
                 raise BadLinkException(url)
 
             print('Requesting url "{}"'.format(url), file=sys.stderr)
-            # Ping the image
-            head = requests.head(url)
-            if head.status_code < 200 and head.status_code > 299:
-                raise BadLinkException(url)
+            # Ping the image. A link we cannot reach is reported but is not
+            # fatal: the build machine's connectivity is not a property of
+            # the book. GitHub runners have no IPv6 route, for example, so
+            # any host with an AAAA record (www.gnu.org) raises
+            # "[Errno 101] Network is unreachable" even though it is fine.
+            try:
+                head = requests.head(url, timeout=link_timeout_seconds)
+            except requests.exceptions.RequestException as e:
+                print('WARNING: could not reach "{}": {}'.format(url, e),
+                      file=sys.stderr)
+                return elem
+
+            if not (200 <= head.status_code <= 299):
+                print('WARNING: url "{}" returned status {}'.format(
+                    url, head.status_code), file=sys.stderr)
 
             # Otherwise reset the cache
             link_cache[url] = datetime.datetime.now().isoformat()

security/security.tex

@@ -341,7 +341,7 @@ More and more of our systems are hacked over the web, it is important to underst
 
 \subsection{Security at the DNS Level}
 
-As of 2019, the United States Department of Homeland Security released a directive to switch all services from DNS to DNSSec \url{https://cyber.dhs.gov/assets/report/ed-19-01.pdf}.
+As of 2019, the United States Department of Homeland Security released a directive to switch all services from DNS to DNSSec \url{https://www.cisa.gov/news-events/directives/ed-19-01-mitigate-dns-infrastructure-tampering-closed}.
 This directive is an inherent flaw of the DNS system.
 First, DNS doesn't offer any sort of verification on domain name requests.
 That is, it is easy to spoof DNS nameservers such that they point your browser to potentially malicious servers.